scholarly journals A REVIEW OF FLOW CONFLICTS AND SOLUTIONS IN SOFTWARE DEFINED NETWORKS (SDN)

2021 ◽  
Vol 22 (2) ◽  
pp. 178-187
Author(s):  
Mutaz Hamed Hussien Khairi ◽  
PM. IR. DR. Sharifah Hafizah Syed Ariffin ◽  
PROF. MADYA DR. Nurul Muazzah Abdul Latiff ◽  
DR. Kamaludin Mohamad Yusof ◽  
Mohamed Khalalfalla Hassan
Keyword(s):  
Plane Layer ◽  
Traffic Load ◽  
Detection Methods ◽  
Software Defined Networks ◽  
Security Model ◽  
Control Plane ◽  
Open Flow ◽  
Data Plane ◽  
And Control ◽  
Networking Technology

 Software Defined Networks (SDN) are a modern networking technology introduced to simplify network management via the separation of the data and control planes. Characteristically, flow entries are propagated between the control plane layer and application or data plane layers respectively while following flow table instructions through open flow protocol. More often than not, conflicts in flows occur as a result of traffic load and priority of instructions in the data plane. Several research works have been conducted on flow conflicts in SDN to reduce the effect of conflict. The flow conflict solutions in SDN have three main limitations. First, the OpenFlow table may still cause a defect in the security module according to the priority and action matching in the open flow in the control plane. Second, flow conflict detection requires more time for flow tracking and incremental update, whereas in such a case, delay affects the efficiency of SDN. Besides, the SDN algorithm and mechanism have substantially high memory requirement for instruction and proper functioning. Third, most of the available algorithms and detection methods used to avoid flow conflicts have not fully covered the security model policy. This study reviews these limitations and suggest solutions as future open research directions. ABSTRAK: Rangkaian Perisian Tertentu (SDN) adalah teknologi rangkaian moden yang diperkenalkan bagi memudahkan pengurusan rangkaian melalui pecahan data dan kawalan permukaan. Seperti biasa, aliran kemasukan disebar luas antara lapisan permukaan kawalan dan aplikasi atau lapisan permukaan data masing-masing, sambil mengikuti arahan meja melebar melalui protokol aliran terbuka. Kebiasaannya konflik dalam aliran berlaku disebabkan oleh beban trafik dan keutamaan arahan pada permukaan data. Beberapa kajian dibuat terhadap konflik aliran SDN bagi mengurangkan kesan konflik. Solusi konflik aliran dalam SDN mempunyai tiga kekurangan besar. Pertama, jadual Aliran Terbuka mungkin masih menyebabkan  kekurangan dalam modul keselamatan berdasarkan keutamaan dan tindakan persamaan dalam aliran terbuka permukaan kawalan. Kedua, pengesanan aliran konflik memerlukan lebih masa bagi pengesanan aliran dan peningkatan kemaskini, kerana setiap penangguhan memberi kesan terhadap kecekapan SDN. Selain itu, algoritma SDN dan mekanisme memerlukan memori yang agak besar bagi memproses arahan dan berfungsi dengan baik. Ketiga, kebanyakan algoritma dan kaedah pengesanan yang digunakan bagi mengelak konflik pengaliran tidak sepenuhnya dilindungi polisi model keselamatan. Oleh itu, kajian ini meneliti kekurangan dan memberi cadangan penambahbaikan bagi arah tuju kajian masa depan yang terbuka.

scholarly journals ADAPTIVE ENTROPY-BASED DETECTION AND MITIGATION OF DDOS ATTACKS IN SOFTWARE DEFINED NETWORKS

2020 ◽  
pp. 399-410
Author(s):  
Jawad Dalou' ◽  
Basheer Al-Duwairi ◽  
Mohammad Al-Jarrah
Keyword(s):  
Denial Of Service ◽  
Attack Detection ◽  
Point Of View ◽  
Software Defined Networks ◽  
Distributed Denial Of Service ◽  
Ddos Attacks ◽  
Control Plane ◽  
Data Plane ◽  
And Control ◽  
Sdn Controller

Software Defined Networking (SDN) has emerged as a new networking paradigm that is based on the decoupling between data plane and control plane providing several benefits that include flexible, manageable, and centrally controlled networks. From a security point of view, SDNs suffer from several vulnerabilities that are associated with the nature of communication between control plane and data plane. In this context, software defined networks are vulnerable to distributed denial of service attacks. In particular, the centralization of the SDN controller makes it an attractive target for these attacks because overloading the controller with huge packet volume would result in bringing the whole network down or degrade its performance. Moreover, DDoS attacks may have the objective of flooding a network segment with huge traffic volume targeting single or multiple end systems. In this paper, we propose an entropy-based mechanism for Distributed Denial of Service (DDoS) attack detection and mitigation in SDN networks. The proposed mechanism is based on the entropy values of source and destination IP addresses of flows observed by the SDN controller which are compared to a preset entropy threshold values that change in adaptive manner based on network dynamics. The proposed mechanism has been evaluated through extensive simulation experiments.

scholarly journals A critical review based on Fault Tolerance in Software Defined Networks

2021 ◽  
Vol 12 (2) ◽  
pp. 456-461
Author(s):  
Ms. Shailly
Keyword(s):  
Fault Tolerant ◽  
Decoupling Control ◽  
Critical Survey ◽  
Software Defined Networks ◽  
Control Plane ◽  
Tabular Data ◽  
Plane Failure ◽  
Failure Handling ◽  
Data Plane ◽  
And Control

SDN (Software-Defined Networks) is an incipient architecture of decoupling control plane and data plane involved in dynamic management of network. SDN is being installed in production based networks which ultimately lead to the need of secure and fault tolerant SDN. In the present investigation, we     are discussing about the kind of failures with label happen in SDN. A critical survey based on the recently proposed mechanisms for handling failures in SDN. Initially, we discussed with the help of tabular data involving mechanism of data plane failure. We also discussed the various mechanisms for handling misconfiguration of drift able of switches and control plane failure handling mechanisms. We also epitomize issues with both data and control plane mechanism that are discussed earlier. In the end, we are stating that there is need of build much efficient and secure mechanism for SDN networks.

scholarly journals Performance Evaluation of Pox Controller for Software Defined Networks

2019 ◽  
Vol 8 (9S2) ◽  
pp. 679-684
Keyword(s):  
Performance Metrics ◽  
Network Control ◽  
Network Services ◽  
Software Defined Network ◽  
Software Defined Networks ◽  
Control Plane ◽  
Data Plane ◽  
Pox Controller ◽  
New Challenges ◽  
And Control

In traditional network the coupling of data plane and control plane makes the data forwarding, processing and managing of the network hard and complex. Here each switch takes its own decision, makes the network logically decentralized. To overcome the limitations in traditional network the Engineers developed a new model network known as Software Defined Network (SDN). This network the control plane is decoupled from the data plane making it less complex. It moreover has a logically centralized approach unlike the existing network. This separation enables the network control to be directly programmable and the architecture to be abstracted for applications and network services. SDN platform provides advantages like programmability, task virtualization and easy management of the network. However, it faces new challenges towards scalability and performances. It is a must to understand and analyze the performances of SDN for implementation and deployment in live network environments. SDN working with POX is studied. This paper analyses the working of POX controller and evaluates the performance metrics of POX controller for SDN environment. The emulation is done using the Emulation software

Software Defined Networks—A Network Programme and Its Dynamic Services

2020 ◽  
Vol 17 (9) ◽  
pp. 3927-3933
Author(s):  
B. Vineetha ◽  
M. Sumana
Keyword(s):  
Control System ◽  
Load Balancing ◽  
Network Services ◽  
Software Defined Networks ◽  
Control Plane ◽  
Service Function ◽  
Flow Through ◽  
And Control ◽  
Dynamic Services ◽  
Network Component

As network component is increasing, the managing and controlling systems from a central based control system becomes very complex. The technology used to resolve this is called Software Defined Networks (SDN) which helps to manage and control the system through programs. SDN stands as a developing technique that divides single network as data and control plane. The benefit of SDN are provides more performance, managing the packet flow through diverse dealer’s organization components. The complexities continued to raise when implementing network services both from technical and organizational views. Here in this paper generally focuses on how organizations can deal with the challenge of introducing service chaining and developing critical network services by using the technology SDN and also delivering diverse services of network to user in one system thus customers can fulfill their desire of services based on requests. The “Service Function Chaining” facility of SDN provides services like Load Balancing, Video Optimizing and Firewall.

scholarly journals SSG - A Solution to Prevent Saturation Attack on the Data Plane and Control Plane in SDN/Openflow Network

2019 ◽  
Vol 2019 (1) ◽  
Author(s):  
Đặng Văn Tuyên ◽  
Trương Thu Hương
Keyword(s):  
Network Security ◽  
Control Plane ◽  
Number Of Solutions ◽  
Tcp Protocol ◽  
Security Challenges ◽  
Packet Latency ◽  
Data Plane ◽  
And Control ◽  
Tcp Connections ◽  
Resource Saturation

The SDN/Openflow architecture opens new opportunities for effective solutions to address network security problems; however, it also brings new security challenges compared to the traditional network. One of those is the mechanism of reactive installation for new flow entries that can make the data plane and control plane easily become a target for resource saturation attacks with spoofing technique such as SYN flood. There are a number of solutions to this problem such as Connection Migration (CM) mechanism in Avant-Guard solution. However, most of them increase load to the commodity switches and/or split benign TCP connections, which can cause increase of packet latency and disable some features of the TCP protocol. This paper presents a solution called SDN-based SYN Flood Guard (SSG), which takes advantages of Openflow’s ability to match TCP Flags fields and the RST Cookie technique to authenticate three-way handshake processes of TCP connections in a separated device from SDN/Openflow switches. The experiment results reveal that SSG solves the aforementioned problems and improves the SYN Flood.

scholarly journals Proposed approach to detect distributed denial of service attacks in software defined network using machine learning algorithms

2018 ◽  
Vol 7 (2.8) ◽  
pp. 472 ◽  
Author(s):  
Shruti Banerjee ◽  
Partha Sarathi Chakraborty ◽  
. .
Keyword(s):  
Machine Learning ◽  
Denial Of Service ◽  
Learning Algorithms ◽  
Machine Learning Algorithms ◽  
Paper Machine ◽  
Software Defined Network ◽  
Distributed Denial Of Service ◽  
Control Plane ◽  
Data Plane ◽  
And Control

SDN (Software Defined Network) is rapidly gaining importance of ‘programmable network’ infrastructure. The SDN architecture separates the Data plane (forwarding devices) and Control plane (controller of the SDN). This makes it easy to deploy new versions to the infrastructure and provides straightforward network virtualization. Distributed Denial-of-Service attack is a major cyber security threat to the SDN. It is equally vulnerable to both data plane and control plane. In this paper, machine learning algorithms such as Naïve Bayesian, KNN, K Means, K-Medoids, Linear Regression, use to classify the incoming traffic as usual or unusual. Above mentioned algorithms are measured using the two metrics: accuracy and detection rate. The best fit algorithm is applied to implement the signature IDS which forms the module 1 of the proposed IDS. Second Module uses open connections to state the exact node which is an attacker and to block that particular IP address by placing it in Access Control List (ACL), thus increasing the processing speed of SDN as a whole. 

A Method for the Stateful Data-Plane Algorithm State Synchronization in the Network Processing Unit

2021 ◽  
Vol 33 (4) ◽  
pp. 69-76
Author(s):  
Yaroslav Konstantinovich Kuzmin ◽  
Dmitry Yuryevitch Volkanov ◽  
Julia Alexandrovna Skobtsova
Keyword(s):  
Processing Unit ◽  
Software Defined Networks ◽  
Packet Processing ◽  
Control Plane ◽  
Hardware Support ◽  
Control Information ◽  
Data Plane ◽  
Network Switches ◽  
Network Processing

This work presents a network processing unit based on specialized computational cores that is used for packet processing in network devices (e.g. in network switches). Nowadays stateful data-plane algorithms are developing in software-defined networks. The idea of stateful data-plane algorithms is to move a part of control information from control plane to data plane. But these algorithms require hardware support because they need resources for state handling. This work presents the network processing unit architecture modifications that allow to use stateful data-plane algorithms that require state synchronization between the NPU processing pipelines.

scholarly journals An Enhanced Message Distribution Mechanism for Northbound Interfaces in the SDN Environment

2021 ◽  
Vol 11 (10) ◽  
pp. 4346
Author(s):  
Chenhui Wang ◽  
Hong Ni ◽  
Lei Liu
Keyword(s):  
Control Plane ◽  
Message Queue ◽  
Ip Network ◽  
Data Plane ◽  
Control Response ◽  
Basic Functions ◽  
The Cost ◽  
New Generation ◽  
And Control ◽  
High Degree

Software-Defined Network (SDN), which is recommended as a new generation of the network, a substitute for TCP/IP network, has the characteristics of separation of data plane and control plane. Although the separation of the control plane brings a high degree of freedom and simple operation and maintenance, it also increases the cost of north–south communication. There are many additional modules for SDN to modify and enhance the basic functions of SDN. This paper proposes a message queue-based northbound communication mechanism, which pre-categorizes messages from the data plane and accurately pushes them to the apps potentially interested. This mechanism improves the efficiency of northbound communication and apps’ execution. Furthermore, it supports both OpenFlow and the protocol-independent southbound interface, and it has strong compatibility. Experiments have proved that this mechanism can reduce the control-response latency by up to 41% when compared with the normal controller northbound communication system, and it also improves the network situation of the data plane, such as real-time bandwidth.

Dynamical Traffic Engineering in Software-Defined Network

2014 ◽  
Vol 610 ◽  
pp. 954-958 ◽  
Author(s):  
Yi Fan Yu ◽  
Yong Li ◽  
De Peng Jin
Keyword(s):  
Linear Programming ◽  
Real Time ◽  
Traffic Engineering ◽  
Network Architecture ◽  
Optimal Solution ◽  
Software Defined Network ◽  
Software Defined Networks ◽  
Control Plane ◽  
Two Stage ◽  
Data Plane

Software-Defined Networks (SDN), as newly proposed network architecture, has a great potential in optimizing network traffics. In SDN, the control plane is separated from the data plane. With the help of the centralized controller, we can gather information of the network in real time. In this work, we propose a practical two-stage approach for traffic engineering that takes advantages of SDN. The approach not only assures every newly injected flow gets a suitable route that does not have too much payload on it, but also schedules the overall flows so that they are distributed more equally in the network. Furthermore, we demonstrate its efficiency in terms of port speed and compared it with port speed under the default routing decision. We also use linear programming to find the optimal solution and compare it with our result.

Sign in / Sign up

Export Citation Format

Share Document